, CFE (713) 341-1708 David.Greetham@ricoh-usa.com EXPERIENCE: David Greetham is the National Director of Forensic Services at HSSK Forensics, a Ricoh Company. He has testified as an expert on numerous occasions both nationally and internationally. Notably, David provided testimony in the landmark Coleman Holdings v Morgan Stanley case. He is a member of the Association of Certified Fraud Examiners and is a Certified Computer Crime Investigator by the High Tech Crime Network. David is a Certified Fraud Examiner and is also a member of the Association of British Investigators and Digital Forensic Research Workshops (DFRWS). He is a frequent speaker for Bar Association meetings and continuing legal education events. David completed his Masters of Science in Forensic Computing from Cranfield University, considered as one of the top five technical universities in the world, which is based at the Defense Academy of the United Kingdom. In addition, David is the inventor and developer of Remlox, a patent pending forensically sound remote collection tool which has already been used in 36 countries throughout the world. PROFESSIONAL HISTORY: 2007 to Present: National Director of Forensic Services, HSSK Forensics, a Ricoh Company National Director of Forensic Services (previously, Managing Director of Computer Forensics) in a professional services firm providing computer forensics, electronic data discovery, fraud examinations, and consulting services in relation to complex technical matters concerning forensics analysis, and electronic processing and production of electronically stored information (ESI) in litigious matters. Director of uniquely accredited forensic lab, leading a team of computer forensic experts. Lead teams of forensics specialists in collection and processing matters, both nationally and international, covering 6 continents. 2004 to 2007: VP, Electronic Evidence, First Advantage Litigation Consulting Performing investigations and consulting relative to electronic evidence included in large scale litigations involving up to 12,000 custodians. David oversaw the litigation through the entire data life span, from pre-litigation consulting, data collection, data culling and converting, preparation of data for attorney review, and expert testimony; additionally responsible for forensic examinations of computer systems involved in data theft (trade secrets), Internet misuse, and alleged spoliation and risk management in relation to network security; authored and implemented Standard Operating Procedures throughout the Forensics Department, ensuring that high standards were being observed and standardization of procedures and tools were consistent throughout the division, including documented testing of results collated when sampling new tools and techniques. 1998 to 2004: CEO and President, PC Forensics Ran an International Computer Forensics Company. As head of investigations, David was responsible for training new investigators in computer forensics and forensic analysis of mobile devices (cell phones, Psion organizers, PDAs, etc.); designed and installed procedures for competent forensic investigations; planned hardware specifications to effectively facilitate thorough investigations; represented both plaintiffs and defendants in civil and criminal matters; performed computer forensic analysis on over 400 hard drives; provided evidence as expert witness on over 20 occasions in five different countries; consulted with corporate clients and assisted with staff selection in positions of IT Security.
1996 to 1998: Forensic Manager, Grampian Technical Services Managed the daily operation of investigations company including case management and client relations; responsible of six investigation staff; developed techniques for secure data deletion for local law enforcement agency; provided testimony in various courts and hearings in relation to electronic evidence; coordinated local forensic community forum; and lectured part-time at local college in area of computer security. PROFESSIONAL AFFILIATIONS & ACTIVITIES: ACCREDITATIONS & LICENSES: 2008 Steering Committee, Association of Litigation Support Professionals, Houston Chapter (ALSP Houston Chapter) 2008 Chair, ALSP Houston Chapter, Computer Forensics Special Interest Group Association of British Investigators Association of Certified Fraud Examiners (ACFE) Digital Forensic Research Workshops (DFRWS) Member, High Technology Crime Investigation Association Certified Fraud Examiner (CFE), Association of Certified Fraud Examiners Licensed Private Investigator, State of Florida, Computer Forensics Licensed Private Investigator, State of Texas, Computer Forensics Director, American Society of Crime Lab Director/Lab Accreditation Board (ASCLD/LAB) forensic lab CERTIFICATIONS: Certified Computer Crime Investigator High Tech Crime Network PG Certificate Forensic Computing Cranfield University PG Diploma Forensic Computing Cranfield University EDUCATION: PUBLICATIONS: Completed Masters of Science in Forensic Computing at Cranfield University, one of the top five technical universities in the world, which is based at the Defense Academy of the United Kingdom. Cranfield University Guidance Software Access Data Corporation PowerQuest Corperation Grampian Technical Services Bond Solon Computer Forensics Foundation I & II, Computer Forensics Advanced, Internet Investigations, Forensic Networks, Forensic Internet, Legal Issues and Courtroom Skills, and System Programming EnCase Intermediate Training Advanced Windows Forensics Data Recovery Techniques PDA Forensics Responsibilities of an Expert Witness Co-Author, The Issue with Exceptions, Making Counsel Fully Aware is Critical to Success, Litigation Support Today, August-October 2012 White Paper, Live Data Acquisition: The New Default Standard for Capturing ESI?, Ricoh Legal, April 2012 Co-Author, Computer Forensics for the New or Young In-House Lawyer, In-House Litigator- The American Bar Association Section of Litigation, December 2008, Vol. 23, No. 1 White Paper, Computer Forensics in Family Law Matters, South Texas College of Law, March 2008 White Paper, Illicit Use of Alternate Data Streams, Cranfield University
RECENT SPEAKING ENGAGEMENTS: Remote Collections: Forensic Defensibility, Women in ediscovery, Minneapolis, Minnesota, March 2013 Computer Forensics: Behind the Curtain, Briggs & Morgan, Minneapolis, Minnesota, March 2013 Computer Forensics Beyond the Basics, Messerli & Kramer, Minneapolis, Minnesota, March 2013 Computer Forensics Beyond the Basics, National Fuel Gas Distribution Corporation, Williamsville, New York, January 2013 Computer Forensics Beyond the Basics, Hodgson Russ, LLP, Buffalo, New York, January 2013 Computer Forensics Beyond the Basics, Phillips Lytle, Buffalo, New York, January 2013 Computer Forensics Beyond the Basics, Jaekle Fleischmann & Mugel, LLP, Buffalo, New York, January 2013 Computer Forensics Beyond the Basics, Bryan Cave, New York, New York, January 2013 Computer Forensics Behind the Curtain, Women in ediscovery, Philadelphia, Pennsylvania, December 2012 Computer Forensics How to Contain Discovery Cost Using Forensic Processes, Flaster Greeneberg, Pittsburgh, Pennsylvania, December 2012 Computer Forensics Beyond the Basics, PNC Financial, Pittsburgh, Pennsylvania, December 2012 Computer Forensics Advanced Analysis, Computer History Museum, Mountain View, California, December 2012 Computer Forensics- Behind the Curtain, Bryan Cave, St. Louis, Missouri, November 2012 Computer Forensics Beyond the Basics, Bryan Cave, Irvine, California, July 2012 Computer Forensics Beyond the Basics, Rutan & Tucker, LLP, Irvine, California, July 2012 Electronic Discovery & Computer Forensics Understanding Beyond the Basics, International Paper, Memphis, Tennessee, July 2012 Computer Forensics A Potential Method to Uncover Hidden Assets, Eisner Amper LLP, Bridgewater, New Jersey, July 2012 Computer Forensics Beyond the Basics, Nilan Johnson Lewis, P.A., Minneapolis, Minnesota, April 2012 Social Media A Discovery Challenge, Minnesota Association of Litigation Support Professionals, (MALSP) April 2012 Computer Forensics Beyond the Basics, Navistar, Chicago, Illinois, March 2012 Computer Forensics & E-Discovery Advantage through Knowledge, Schiff Hardin LLP, March 2012 Computer Forensics Be Informed!, Steele Sturm, P.L.L.C, Houston, Texas, December 2011 Computer Forensics Beyond the Basics, Faegre & Benson, L.L.P., Minneapolis, Minnesota, November 2011
Computer Forensics Beyond the Basics, Minnesota Paralegal Association, Minneapolis, Minnesota, November 2011 Detection of Accounting Fraud using Computer Forensics, Houston CPA Society Houston TSCPA Foundation Annual Conference, Houston, Texas, May 2011 Electronic Intrusion & Computer Forensics, Associations of Legal Administrators Kentucky Chapter, Louisville, Kentucky, March 2011 The Use of Computer Forensics to Detect Fraud, Houston CPA Society, Houston, Texas, January 2011 "Self-Collection Prudent Cost Savings or an Unnecessary Risk?, Women in E-Discovery Atlanta Chapter, Atlanta, Georgia, June 2009 "Pre-Processing Cost Savings, Association of Litigation Support Professionals Houston Chapter, Houston, Texas, May 2009 "The Future of Computer Forensics, National Space and Technology Association, Houston, Texas, April 2009 EXPERT WITNESS TESTIMONY: Expert witness for the prosecution in large child pornography case involving distribution of illicit images utilizing the Internet. Expert witness for plaintiff/prosecution in international theft of trade secrets case, providing testimony in both criminal court in Denmark and civil court in United Kingdom. Testimony encompassed the explanation of how deleted files can be recovered and demonstrated relevance of content of recovered deleted files which were key in this matter. Single Joint Expert (SJE) for two parties disputing alleged theft of proprietary information. Granted SJE status by the court and required to thoroughly investigate all allegations in relation to emails, database input, digital copyright and electronic ownership issues. Testimony after investigation enabled Judge to be fully versed with electronic audit trails as well as technical matters in relation to software ownership. Expert witness for large software vendor in civil matter concerning the production and distribution of counterfeit software. Testified over a period of two and one-half days. Expert witness for defendant in case concerning allegation of unauthorized access to remote computer network, utilizing the Internet. Testimony included live demonstration of an anonymizer. Testifying expert in Bankruptcy Court detailing failings with electronic discovery planning and application by Specialist Electronic Discovery agents. RECENT U.S. EXPERT WITNESS TESTIMONY: Adrian Arrington, Derek Owens, Mark Turner, and Angela Palacios individually and on behalf of all others similarly situated, v National Collegiate Athletic Association May 2012, Case No. 11-cv-06356 in the United States District Court of Northern Illinois (Eastern Division). Engaged to testify at an ESI protocol hearing on behalf of defendants, detailing forensically sound and efficient methodologies that can be used to collect, review and produce large quantities of ESI. The State of Texas v Jeffrey Stern February 2012 Case No. 1293162 & 1293163 in the 262 nd Criminal District Court of Harris County, Texas. William R. and Susan M. Knoderer v State Farm Lloyds, Penny Perkins and Tom Roberts August 2011, Case No. 74-037 in the District Court of Hunt County, Texas. Engaged to testify in relation to the effective management and segregation of responsive and privileged documents, in an E- Discovery document review and production process.
Norit Americas Inc., v ADA-ES, Inc., et. al. September 2010, October 2010 Case No. 30-192-Y-00718-09 in the American Arbitration Association of Atlanta, Georgia. Engaged to testify regarding the analysis of metadata, and it s use in assisting with ascertaining original document ownership Ashland, Inc. v James A. Cecere March 2010 Case No. 10CV-3039 in the Court of Common Pleas of Franklin County, Ohio (Civil Division). Testified demonstrated that a USB device had been used to copy proprietary and confidential company documents, by a departing employee. United States of America vs. Faraj Salim Said November 2009 Case No. H-09-660 in the United States District Court of Texas (Houston Division). Testified in relation to the effective forensic analysis of electronic evidence, specifically in relation to tracking the source of downloads from the Internet. Appling Farms, et. al. v John Turner, et. al. April 2009 Testified in relation to the forensics examination of computers, in particular, presented evidence demonstrating the secure mass deletion of data, directly prior to the forensic acquisition of computers and related evidence. United States of America v Barry Gitarts September 2008 - Case No. 1:07cr00464 in the United States District Court Eastern District of Virginia (Alexandria Division). Testimony detailed the use of peer to peer networks, and how they have been used to download and distribute copyrighted material. Lewis Equipment Company, et. al. v General Crane (USA) Including Shawn Cluff and Randy Harris September 2008 - Cause No. 2008-0914 in the District Court of Harris County, Texas 234th Judicial District. Testimony detailed the use of MD5 Hash algorithms and how this can be used to compare different datasets for identical files. Richard Mulholland v William H. Winters and Marc E. Yonker June 2008 - Case Nos. 01-5452, 01-5545, 03-2502, 05-5054 in the Circuit Court of the Thirteenth Judicial Circuit of the State of Florida, in and for Hillsborough County, Complex Business Litigation Division. Testimony detailed efficient practices in relation to computer forensics preservation standards and electronic discovery productions. RECENT U.S. EXPERT WITNESS TESTIMONY (CONTINUED): Mark Alber, et. al. v McCall-T. et. al. April 2008 - Cause No. 2006-08098 in the 133 Judicial District Court, Harris County, Texas Presented testimony in relation to validated methodologies used for the safe collection of electronic evidence. In addition, provided a detailed protocol to facilitate a secure and effective data collection, ensuring the integrity of the clients data. Eagle Domestic Drilling Operations, LLC v Hallwood Energy, LP and Hallwood Petroleum, LLC March 2008 - Case No. 07-30426-H4-11 in the United States Bankruptcy Court, Southern District of Texas; Houston Division Testified at sanctions hearing regarding ineffective electronic evidence collection. Oscher (Trustee) v The Solomon Tropp Law Group February 2006 - Cause No. 8:00bk-18057-ALP in the United States Bankruptcy Court for the Middle District of Florida Engaged to testify as expert in Motion for Summary Judgment regarding allegation of misappropriation of funds. Testimony encompassed standards in relation to electronic discovery and failings in the discovery obligations by plaintiffs in this matter.
Oscher (Trustee) v The Solomon Tropp Law Group November 2005 - Cause No. 8:00bk-18057-ALP in the United States Bankruptcy Court for the Middle District of Florida Engaged to testify as expert at deposition in Chapter 11 bankruptcy hearing. Testimony detailed expected standards in electronic discovery and highlighted the failings in this discovery matter. FJQC v Judge Gregory P. Holder June 2005 - Cause No. Sc03-1171, No. 02-487, in the Florida Judicial Qualifications Commission Supreme Court Testified as expert in high profile, televised case in the Supreme Court of Florida. Testimony detailed technical structure of backup tapes, and the procedures required to make fake backups. Testimony also encompassed how the Windows Operating System functions, and how it provides date and time stamps. Coleman (Parent) Holdings, Inc. v Morgan Stanley & Co., Inc. April 2005 - Cause No: 03 CA-005045 AI in the 15 th Judicial District Court of Palm Beach County, Florida Engaged to provide written testimony as computer forensic expert in billion dollar civil litigation specifically in relation to metadata. In particular, testimony detailed the differences between metadata and in-house document management systems; explaining what makes the two technologies fundamentally distinct, and clarifying the differences between the expected results during analysis. Morgan Stanley Dean Witter v Menaged December 2004 - Engaged by counsel for Defendant to testify as expert in securities mismanagement arbitration. Testimony encompassed the recovery of relevant deleted Web pages from the claimant s computer and included the reconstruction of Internet history activity for a specific time period in September 2000. FJQC v Judge Gregory P. Holder September 2004 - June 2005 - Cause No. Sc03-1171, No. 02-487, in the Florida Judicial Qualifications Commission Supreme Court Engaged by counsel for Defendant to testify as expert in high profile alleged plagiarism case. Testimony encompassed authenticating backup tapes and the documents contained within. Also demonstrated procedures required to create fake backup tapes. HSSK Houston is distinguished as operating the NATION S FIRST private Computer Forensics lab accredited by the American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB).